package org.yutian.springboot.dao;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.stereotype.Component;

import java.util.List;
import java.util.Map;

/**
 * 优先级：jdbcTemplate 优先于datasource 优先于 connection
 *
 * 禁止拼装sql：“jdbcTemplate.update("update student set age = 29,`last` ='yutian' where id=" + id);”，因为存在sql注入的风险，如id="2 or 1=1"
 *
 * 必须使用绑定变量的方式：“jdbcTemplate.update("update student set age = 29,`last` ='yutian' where id=?", id);”
 */
@Component
public class JdbcToolDao {
    @Autowired
    private JdbcTemplate jdbcTemplate;

    public List<Map<String, Object>> select(long id){
        return jdbcTemplate.queryForList("SELECT id, `first`, `last`, age FROM testyt.student where id = ?", id);
    }

    public int update(String id){
        return jdbcTemplate.update("update student set age = 29,`last` ='yutian' where id=?", id);
    }
}
